 Re: Open or Closed
Block everything except that which is explicitly allowed is the only sane approach. Blocking only specific ports is just stupid, and will not protect your network effectively.
Regarding dynamic traffic, you've got two options:
* Use Check Point or similar to perform a deeper inspection of the traffic, so that it is aware of what the dynamic traffic is, and only allows what's required
* Configure the application to use a restricted range of ports. With OpenView e.g., this is quite straightforward. |